Monthly
Privilege escalation and local code execution affect the OpenTelemetry.Resources.Host NuGet package (opentelemetry-dotnet-contrib) on macOS prior to version 1.16.0-beta.2. The host.id resource attribute detector invokes sh and ioreg using bare names resolved through the PATH environment variable rather than absolute paths, allowing a local attacker with fewer privileges than the host application to substitute malicious binaries and execute arbitrary code in the application's security context. No public exploit has been identified at time of analysis; Linux and Windows hosts are explicitly unaffected.
Privilege escalation in Okta Hyperdrive Integration Plugin (versions 1.2.0 through pre-1.5.2) stems from the plugin resolving a .NET assembly path via the current user's HKCU registry hive and loading it with Assembly.LoadFrom without any signature or integrity check. A local attacker with standard user privileges who can write to the relevant HKCU registry key can redirect the load path to a malicious DLL, which then executes within the host process or elevated installer context - achieving privilege escalation beyond the attacker's normal trust boundary. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Untrusted search path (CWE-426) in OpenVPN's Windows tapctl utility allows a local low-privileged attacker to substitute a malicious netsh.exe executable when tapctl invokes it without a fully-qualified path. Affected versions span OpenVPN 2.5.0-2.6.22 and 2.7_alpha1-2.7.6 on Windows; the fix was released in v2.7.7. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution under the current user's account by planting a malicious DLL or executable alongside a crafted project file. The root cause (CWE-426) is the application's failure to validate the library search path when loading dependencies at runtime, enabling full compromise of confidentiality, integrity, and availability on the victim host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity, well-understood exploitation technique, and complete C/H/I/A/A impact triad make this a meaningful patching priority for teams whose users open externally sourced project files.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Privilege escalation in the OnGres StackGres operator lets a low-privilege, database-owning tenant elevate to administrator privileges, breaking the multi-tenant isolation model of this Kubernetes-based PostgreSQL platform. The CVSS 9.9 rating with a scope change (S:C) reflects that an authenticated tenant confined to their own database can cross a trust boundary to gain full administrative control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the only public reference is a GitLab work item tracking the flaw.
Privilege escalation and local code execution affect the OpenTelemetry.Resources.Host NuGet package (opentelemetry-dotnet-contrib) on macOS prior to version 1.16.0-beta.2. The host.id resource attribute detector invokes sh and ioreg using bare names resolved through the PATH environment variable rather than absolute paths, allowing a local attacker with fewer privileges than the host application to substitute malicious binaries and execute arbitrary code in the application's security context. No public exploit has been identified at time of analysis; Linux and Windows hosts are explicitly unaffected.
Privilege escalation in Okta Hyperdrive Integration Plugin (versions 1.2.0 through pre-1.5.2) stems from the plugin resolving a .NET assembly path via the current user's HKCU registry hive and loading it with Assembly.LoadFrom without any signature or integrity check. A local attacker with standard user privileges who can write to the relevant HKCU registry key can redirect the load path to a malicious DLL, which then executes within the host process or elevated installer context - achieving privilege escalation beyond the attacker's normal trust boundary. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Privilege escalation via untrusted search path (CWE-426) in the Windows Smart Card subsystem affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated local attacker with low-privilege access can manipulate the DLL/executable search path used by Smart Card components to load and execute attacker-controlled code, achieving full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Local privilege escalation in Windows Storage affects virtually every supported Windows client and server release, allowing an authorized low-privilege local attacker to gain full SYSTEM-level control without any user interaction. The root cause is CWE-426 (Untrusted Search Path): the Storage component resolves a DLL or executable from a path the attacker can influence, causing elevated-privilege code to load attacker-controlled content. No public exploit or active exploitation has been identified at time of analysis, but the low complexity and broad platform coverage make this a high-priority patch target.
Untrusted search path (CWE-426) in OpenVPN's Windows tapctl utility allows a local low-privileged attacker to substitute a malicious netsh.exe executable when tapctl invokes it without a fully-qualified path. Affected versions span OpenVPN 2.5.0-2.6.22 and 2.7_alpha1-2.7.6 on Windows; the fix was released in v2.7.7. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Untrusted Search Path exploitation in Adobe Substance 3D Painter allows an attacker to achieve arbitrary code execution under the current user's account by planting a malicious DLL or executable alongside a crafted project file. The root cause (CWE-426) is the application's failure to validate the library search path when loading dependencies at runtime, enabling full compromise of confidentiality, integrity, and availability on the victim host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity, well-understood exploitation technique, and complete C/H/I/A/A impact triad make this a meaningful patching priority for teams whose users open externally sourced project files.
Untrusted search path execution in NLTK before 3.10.3 allows a local attacker with write access to the current working directory or the ability to insert relative entries into PATH to substitute a malicious executable named 'dot' for the legitimate Graphviz binary, achieving arbitrary code execution under the invoking process's privileges. The affected code paths are dependencygraph.dot2img and AlignedSent._repr_svg_, both of which invoke the Graphviz dot binary by bare name without validating an absolute path. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 8.5 reflects the high-impact code execution potential.
Privilege escalation in the OnGres StackGres operator lets a low-privilege, database-owning tenant elevate to administrator privileges, breaking the multi-tenant isolation model of this Kubernetes-based PostgreSQL platform. The CVSS 9.9 rating with a scope change (S:C) reflects that an authenticated tenant confined to their own database can cross a trust boundary to gain full administrative control. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the only public reference is a GitLab work item tracking the flaw.